IPv6 dependability is increasingly inseparable from IPv6 security: Neighbor Discovery (ND), Router Advertisements (RA), and ICMPv6 are essential for correct operation yet expose a broad attack surface for spoofing and flooding. Meanwhile, IPv6's massive address space breaks per-IP reputation and makes many defenses either non-scalable or narrowly scoped (e.g., only internal threats, only RA abuse, or only volumetric floods). We propose a zero-trust edge architecture implemented in a single programmable data-plane pipeline that unifies four modules: external spoofing, internal spoofing, external flooding, and internal flooding. A key design choice is to enforce identity plausibility before rate plausibility: stateless per-packet validation filters spoofed traffic early so that time-window statistics for flooding operate on credible identities. We outline a concrete P4 design (prefix Hop-Limit bands, DAD-anchored address-port bindings, and Count-Min Sketch windowed counting) and evaluate it across a systematic 15-scenario suite spanning single-, dual-, and multi-vector compositions. We report results from a BMv2 prototype and validate the same pipeline on a Netronome NFP-4000 SmartNIC, and we discuss limitations and open directions.

翻译：IPv6的可靠性日益与其安全性密不可分：邻居发现（ND）、路由器通告（RA）和ICMPv6对于正确运行至关重要，但也为欺骗和泛洪攻击暴露了广泛的攻击面。与此同时，IPv6庞大的地址空间破坏了基于单个IP的信誉机制，使得许多防御措施要么无法扩展，要么适用范围狭窄（例如，仅针对内部威胁、仅针对RA滥用或仅针对流量泛洪）。我们提出了一种零信任边缘架构，该架构在单个可编程数据平面流水线中实现，统一了四个模块：外部欺骗、内部欺骗、外部泛洪和内部泛洪。一个关键的设计选择是在速率合理性之前强制执行身份合理性：无状态的每包验证可尽早过滤欺骗流量，从而使针对泛洪的基于时间窗口的统计能够基于可信的身份进行操作。我们概述了一个具体的P4设计（前缀跳数限制带、基于DAD的地址-端口绑定以及Count-Min Sketch窗口计数），并通过一个系统的15种场景套件（涵盖单向量、双向量和多向量组合）对其进行了评估。我们报告了基于BMv2原型的实验结果，并在Netronome NFP-4000 SmartNIC上验证了同一流水线，最后讨论了该方案的局限性及未来的研究方向。